DVWA SQLi shell (lab)

Login to DVWA CSRF token, set security low, UNION SQLi on /vulnerabilities/sqli/; uses lib Sqli pseudo-shell shellsqli or singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ DVWA SQL Injection lab helper authorized testing only. Authenticates like other DVWA KittySploit modules, forces...

Craft CMS CVE-2025-32432 Pre-Auth RCE

Exploits Craft CMS CVE-2025-32432, a pre-authentication remote code execution issue in the assets/generate-transform endpoint. The module poisons the active PHP session and triggers a Yii gadget chain to include the session file through yii\rbac\PhpManager. !/usr/bin/env python3 -- coding: utf-8 ...

Langflow RCE (CVE-2026-27966)

Authenticated RCE in Langflow CSV Agent allowdangerouscode=True via prompt injection. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import random import string from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info ...

Php Base64 Encoder

Encodes php payload in base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Php Base64 Encoder", "description": "Encodes php payload in base64", "author": "KittySploit Team", "platform": Platform.PHP, def encodeself, payload:...

Php Hex Encoder

Encodes php payload in hex format !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Php Hex Encoder", "description": "Encodes php payload in hex format", "author": "KittySploit Team", "platform": Platform.PHP, def encodeself,...

Windows Get GPP Autologon

Search SYSVOL Registry.xml files for Group Policy Preferences autologon credentials on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 import re...

Command History Analyzer

Analyze shell history for suspicious command patterns and incident-response indicators !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: info = "name": "Command History Analyzer", "description": "Analyze shell history for suspicious command patterns and...

Php UrlEncode Encoder

Encodes php payload using URL encoding !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from urllib.parse import quote class ModuleEncoder: info = "name": "Php UrlEncode Encoder", "description": "Encodes php payload using URL encoding", "author": "KittySploit Team", "platform":...

Python Hex Encoder

Encodes payload to hex format !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Python Hex Encoder", "description": "Encodes payload to hex format", "author": "KittySploit Team", "platform": Platform.PYTHON, def encodeself, payloa...

llama.cpp RPC b8487 exposure detection

Detects reachable llama.cpp RPC servers and identifies builds that may be affected by the pre-PR 20908 null-buffer bypass issue. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed llama.cpp RPC server and vulnerable pre-fix builds.""" import socket import struct from kittysploit import...

Exposed .env file detection

Detects publicly accessible .env files containing application secrets or environment configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Détection fichiers .env exposés.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/.env", "/.env.local",...

Invoke-WmiCommand

Executes a PowerShell ScriptBlock on a target computer using WMI as a pure C2 channel. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 import os class ModulePost: info = "name": "Invoke-WmiCommand", "description": "Executes a PowerShell ScriptBlock on a target...

Windows PowerShell Exec

Execute a PowerShell command or script on a Windows shell or Meterpreter session and return its output. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows...

MySQL Info - Enumeration

Connects to a MySQL server and prints information such as protocol, version, TLS support, and transport. !/usr/bin/env python3 -- coding: utf-8 -- """Détection MySQL + récupération d'informations via handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Generex CS141 CVE-2022-47190 - RCE via Firmware Upload

Generex UPS CS141 below 2.06 accepts a crafted firmware archive containing a webshell or equivalent command execution primitive, leading to remote code execution as root. import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import...

WordPress Events <= 2.3.4 Authenticated Hash Dump

The WordPress Events plugin = 2.3.4 contains an authenticated SQL injection in the event editing workflow. Any user able to manage events can abuse it to extract WordPress password hashes from the database. from urllib.parse import urlencode import re from kittysploit import from...

Generex NetMan 204 CVE-2022-47892 - Sensitive Information Disclosure

Generex NetMan 204 exposes sensitive device information via netmandata.json, including MAC address and serial number which can be leveraged to derive the password recovery code. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.netman204 import...

PHPInfo exposure detection

Detects exposed phpinfo pages that disclose PHP configuration, modules, paths, and environment details. !/usr/bin/env python3 -- coding: utf-8 -- """Détection pages phpinfo exposées.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/phpinfo.php", "/info.php...

Invoke-ReflectivePEInjection

Reflectively loads a Windows PE file DLL/EXE into the PowerShell process, or injects a DLL into a remote process. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 import os class ModulePost: info = "name": "Invoke-ReflectivePEInjection", "description": "Reflectively...

Linux Gather Protection Enumeration

Enumerate Linux hardening mechanisms and installed security software from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import re class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Gather Protection Enumeration",...

GTP-U/GTP-C UDP detection

Detects GTP-U 2152 or GTP-C 2123 - 3GPP 4G/5G data/control plane. !/usr/bin/env python3 -- coding: utf-8 -- """Détection GTP-U / GTP-C UDP 2152 / 2123 - 3GPP 4G/5G user/control plane.""" import socket from kittysploit import from core.framework.option import OptPort from...

Elasticsearch detection

Detects exposed Elasticsearch REST API often unauthenticated. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Elasticsearch API REST exposée.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Elasticsearch...

Cloud metadata path detection

Detects HTTP paths that may expose cloud metadata AWS/Azure/GCP/OpenStack. !/usr/bin/env python3 -- coding: utf-8 -- """Détection chemins métadonnées cloud risque SSRF / proxy vers metadata.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient Paths often proxied to clo...

Grafana detection

Detects if Grafana is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Grafana.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Grafana detection", "description": "Detects if Grafana is...

GCP Storage detection

Detects Google Cloud Storage API XML/JSON listing or GCP error format. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Google Cloud Storage exposé.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "GCP Storage...

Docker Registry detection

Detects Docker Registry API v2 image listing possible. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Docker Registry API v2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Docker Registry detection",...

Kubernetes API detection

Detects exposed Kubernetes API version, namespaces, healthz. !/usr/bin/env python3 -- coding: utf-8 -- """Détection API Kubernetes exposée.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import lookslikekuberneteshealth,...

Jenkins detection

Detects if Jenkins CI is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Jenkins CI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Jenkins detection", "description": "Detects if...

AD shadow credentials

Detects accounts with msDS-KeyCredentialLink set PKINIT takeover possible. !/usr/bin/env python3 -- coding: utf-8 -- """Detect shadow credentials msDS-KeyCredentialLink on accounts.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info =...

AD Pre-Windows 2000 access

Detects Pre-Windows 2000 group with Everyone/Anonymous unauthenticated enumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Pre-Windows 2000 Compatible Access group Everyone/Anonymous.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient Well-known SIDs EVERYONE...

AD Kerberoastable accounts

Detects user accounts with SPNs Kerberoast targets. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Kerberoastable accounts users with SPNs.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from lib.protocols.ldap.adhelpers import UACDONTEXPIREPASSWD class...

PHP 8 TimeAfterFree disable_functions bypass

PHP 8 sandbox escape TimeAfterFree — engine-level memory corruption leading to disablefunctions bypass. Targets Unix-like systems. PHP 8.2–8.5. from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 8...

Crt.sh Enumeration

Find subdomains via Cert Transparency crt.sh. from kittysploit import import sys import os import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Crt.sh Enumeration', 'author': 'KittySploit Team',...

Elasticsearch Listener

Elasticsearch listener - creates interactive Elasticsearch shell session !/usr/bin/env python3 -- coding: utf-8 -- """ Elasticsearch listener - connects to an Elasticsearch cluster and creates an interactive session. """ from kittysploit import from elasticsearch import Elasticsearch from...

MongoDB Listener

MongoDB NoSQL listener - creates interactive MongoDB shell session !/usr/bin/env python3 -- coding: utf-8 -- """ MongoDB listener - connects to a MongoDB server and creates an interactive session. """ from kittysploit import from pymongo import MongoClient from pymongo.errors import PyMongoError...

DNS C2 Listener

Listens for DNS queries on a subdomain C2 channel. Agent polls for commands, sends results in query names. Responds with TXT. !/usr/bin/env python3 -- coding: utf-8 -- """ DNS C2 Listener - Listens on UDP for DNS queries on a subdomain and creates sessions. Agent sends: poll.. to get commands,...

PostgreSQL Listener

PostgreSQL database listener - creates interactive PostgreSQL shell session !/usr/bin/env python3 -- coding: utf-8 -- """ PostgreSQL database listener - connects to a PostgreSQL server and creates an interactive session. """ from kittysploit import import psycopg2 class ModuleListener:...

Windows Process Migration

Migrates the Meterpreter session to a different process !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: """Windows Process Migration Module Migrates the Meterpreter session to a different process. This is useful for: - Hiding in a legitimate process -...

LimeSurvey 5.2.4 - Authenticated Remote Code Execution (RCE)

CVE-2021-44967 - LimeSurvey Authenticated RCE via malicious plugin upload !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from bs4 import BeautifulSoup import zipfile import tempfile import os import warnings from io import...

MySQL Database Connection

Connect to MySQL database and execute SQL queries from kittysploit import class ModulePost: info = "name": "MySQL Database Connection", "description": "Connect to MySQL database and execute SQL queries", "author": "KittySploit Team", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent':...

MySQL Listener

MySQL database listener - creates interactive MySQL shell session from kittysploit import import pymysql class ModuleListener: info = 'name': 'MySQL Listener', 'description': 'MySQL database listener - creates interactive MySQL shell session ', 'author': 'KittySploit Team', 'handler': Handler.BIN...

Control Web Panel /admin/index.php Unauthenticated RCE

Control Web Panel CWP versions = 0.9.8.1208 are vulnerable to unauthenticated OS command injection. User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly sanitized before being used to execute OS commands. This can be exploited by...

FTP Upload File

Uploads a local file to the FTP server !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Upload Module""" info = "name": "FTP Upload File", "description": "Uploads a loca...

Detect Properties

Detect comprehensive properties of the browser victim plugins, features, fingerprinting data from kittysploit import import json from datetime import datetime class ModuleBrowserAuxiliary: info = "name": "Detect Properties", "description": "Detect comprehensive properties of the browser victim...

capture all form

Capture all form data from the browser victim from kittysploit import class ModuleBrowserAuxiliary: info = "name": "capture all form", "description": "Capture all form data from the browser victim", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype":...

Get Local Storage

Extract all data from localStorage of the browser victim from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Get Local Storage", "description": "Extract all data from localStorage of the browser victim", "author": "KittySploit Team", "browser": Browser.ALL, "platform...

CMD Base64 Encoder

Encodes command-line payloads in base64 to avoid bad characters. Supports Unix/Linux shells with multiple decoding methods. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "CMD Base64 Encoder", "description": "Encodes command-lin...

Play Sound

Play a sound on the browser victim requires user interaction on modern browsers from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Play Sound", "description": "Play a sound on the browser victim requires user interaction on modern browsers", "author": "KittySploit Team",...

Android Install APK

Install an APK on an Android device from kittysploit import import os class ModulePost: info = 'name': 'Android Install APK', 'description': 'Install an APK on an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects':...

dvwa upload

dvwa upload !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from bs4 import BeautifulSoup from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin class ModuleExploit, Httpclient, Httplogin: info = "name": "dvwa upload",...